@zkproofport-app/sdk 0.5.0-beta.2 → 0.5.0-beta.4

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@zkproofport-app/sdk)](https://www.npmjs.com/package/@zkproofport-app/sdk)
 [![license](https://img.shields.io/npm/l/@zkproofport-app/sdk)](./LICENSE)
 
-TypeScript SDK for requesting zero-knowledge proofs from the [ZKProofport](https://zkproofport.com) mobile app and verifying them on-chain. Three circuits are officially supported today — Coinbase KYC, Coinbase country attestation, and OIDC email-domain attestation (Google, Microsoft 365). Two more prove today against a testnet deployment and are marked experimental: GIWA attestation and Dojang Playground. The three Korean mobile ID (mDL) identifiers are reserved and planned. [Circuit Identifiers](#circuit-identifiers) has the full list and what each status means.
+TypeScript SDK for requesting zero-knowledge proofs from the [ZKProofport](https://zkproofport.com) mobile app and verifying them on-chain. Three circuits are officially supported today — Coinbase KYC, Coinbase country attestation, and OIDC email-domain attestation (Google, Microsoft 365). Two more prove today against a testnet deployment and are marked experimental: GIWA attestation and Dojang Playground. [Circuit Identifiers](#circuit-identifiers) has the full list and what each status means.
 
 ## How It Works
 
@@ -33,7 +33,7 @@ TypeScript SDK for requesting zero-knowledge proofs from the [ZKProofport](https
 ```
 
 1. Your app creates a proof request through the SDK
-2. The SDK asks the relay for a one-time challenge and a tracked request ID. For the Coinbase circuits it also signs that challenge with your wallet signer (EIP-191); the OIDC and mDL circuits need no signature
+2. The SDK asks the relay for a one-time challenge and a tracked request ID. For the Coinbase circuits it also signs that challenge with your wallet signer (EIP-191); the OIDC circuit needs no signature
 3. Your app shows the returned deep link as a QR code (desktop) or navigates to it (mobile)
 4. The user opens the ZKProofport app, which generates the ZK proof on-device
 5. The proof result flows back through the relay to your app over WebSocket (HTTP polling as fallback)
@@ -90,6 +90,7 @@ if (result.status === 'completed') {
     publicInputs: result.publicInputs,
     verifierAddress: result.verifierAddress,
     chainId: result.chainId,
+    signerVariant: result.signerVariant,
   };
 
   const verification = await sdk.verifyResponseOnChain(response);
@@ -99,7 +100,7 @@ if (result.status === 'completed') {
 
 ## Circuit Identifiers
 
-Circuit IDs are canonical, lowercase and case-sensitive: each one is the `name` field of that circuit's `Nargo.toml`, verbatim. Hyphenated spellings such as `coinbase-kyc` or `mdl-kr-age` are route and directory names from elsewhere — they are not circuit IDs, and passing one does not fail with a clear error. It produces a nullifier mismatch or a verifier lookup that finds nothing.
+Circuit IDs are canonical, lowercase and case-sensitive: each one is the `name` field of that circuit's `Nargo.toml`, verbatim. Hyphenated spellings such as `coinbase-kyc` or `oidc-domain` are route and directory names from elsewhere — they are not circuit IDs, and passing one does not fail with a clear error. It produces a nullifier mismatch or a verifier lookup that finds nothing.
 
 This SDK is the single source of truth for that list. Import the constants rather than typing the strings, and a rename becomes a compile error instead of a runtime surprise:
 
@@ -126,28 +127,23 @@ import { CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS } from '@zkproofport-app/sdk/circui
 | `CIRCUIT_IDS.OIDC_DOMAIN_ATTESTATION` | `oidc_domain_attestation` | **Supported** |
 | `CIRCUIT_IDS.GIWA_ATTESTATION` | `giwa_attestation` | _Experimental_ |
 | `CIRCUIT_IDS.DOJANG_PLAYGROUND` | `dojang_playground` | _Experimental_ |
-| `CIRCUIT_IDS.MDL_KR_OWNERSHIP` | `mdl_kr_ownership` | Planned |
-| `CIRCUIT_IDS.MDL_KR_AGE` | `mdl_kr_age` | Planned |
-| `CIRCUIT_IDS.MDL_KR_REGION` | `mdl_kr_region` | Planned |
 
 **Supported** means generally available — build a product on it.
 
 **Experimental** means you can prove it today and it verifies, but only against a testnet deployment. Inputs, public-input layout and the verifier address can change without a major version bump, and there is no mainnet to point at. Try it; do not ship on it.
 
-**Planned** means the identifier is reserved and the circuit exists, but it is not officially supported yet: availability, inputs and public-input layout can change without a major version bump.
+**Planned** marks an identifier reserved ahead of official support; inputs and public-input layout can change without a major version bump. No circuit has this status today.
 
-Every ID appears in `CircuitType` and in `sdk.getSupportedCircuits()`, planned ones included, so being assignable is not a support guarantee. Gate on the status, not on the type:
+Every ID appears in `CircuitType` and in `sdk.getSupportedCircuits()`, experimental ones included, so being assignable is not a support guarantee. Gate on the status, not on the type:
 
 ```typescript
 import { CIRCUIT_SUPPORT_STATUS, isSupportedCircuitId } from '@zkproofport-app/sdk';
 
 CIRCUIT_SUPPORT_STATUS.coinbase_attestation; // 'supported'
 CIRCUIT_SUPPORT_STATUS.giwa_attestation;     // 'experimental'
-CIRCUIT_SUPPORT_STATUS.mdl_kr_age;           // 'planned'
 
 isSupportedCircuitId('oidc_domain_attestation'); // true
 isSupportedCircuitId('giwa_attestation');        // false — experimental is not supported
-isSupportedCircuitId('mdl_kr_age');              // false
 isSupportedCircuitId('coinbase-kyc');            // false — not an ID at all
 ```
 
@@ -163,14 +159,14 @@ isSupportedCircuitId('coinbase-kyc');            // false — not an ID at all
 | `isCircuitId(value)` | `value is CircuitId` | Narrows an unknown value; `false` for hyphenated names |
 | `isSupportedCircuitId(value)` | `value is CircuitId` | The same, and additionally requires `supported` |
 | `getCircuitSupportStatus(id)` | `CircuitSupportStatus` | Status of one ID; throws on an unknown one |
-| `CircuitId` | type | Union of the eight IDs. `CircuitType` is an alias of it |
-| `CircuitSupportStatus` | type | `'supported' \| 'planned'` |
+| `CircuitId` | type | Union of the five IDs. `CircuitType` is an alias of it |
+| `CircuitSupportStatus` | type | `'supported' \| 'experimental' \| 'planned'` |
 
 Both objects and all three arrays are frozen. `ALL_CIRCUIT_IDS`, `SUPPORTED_CIRCUIT_IDS` and `PLANNED_CIRCUIT_IDS` are derived from `CIRCUIT_SUPPORT_STATUS` at load time, so they cannot disagree with it.
 
 ## Supported Circuits
 
-The circuits below are officially supported. Pass their IDs exactly as written, or use the `CIRCUIT_IDS` constants. `sdk.getSupportedCircuits()` returns every known ID at runtime, planned ones included — see [Circuit Identifiers](#circuit-identifiers).
+The circuits below are officially supported. Pass their IDs exactly as written, or use the `CIRCUIT_IDS` constants. `sdk.getSupportedCircuits()` returns every known ID at runtime, experimental ones included — see [Circuit Identifiers](#circuit-identifiers).
 
 ### `coinbase_attestation`
 
@@ -334,7 +330,7 @@ circuit names are special:
 | What the circuit does with an action | Circuits |
 |---|---|
 | Signs it when present, signs the signal hash when not | `giwa_attestation`, `dojang_playground` |
-| Has no action inputs — sending one is refused, not ignored | Coinbase KYC, Coinbase country, OIDC domain, the three mDL circuits |
+| Has no action inputs — sending one is refused, not ignored | Coinbase KYC, Coinbase country, OIDC domain |
 
 ```typescript
 import { circuitActionBinding } from '@zkproofport-app/sdk';
@@ -347,62 +343,6 @@ Sending an action to a circuit that cannot prove one is an error rather than a
 silent drop: a dropped action would leave you believing a proof authorized
 something the circuit never saw.
 
-## Planned Circuits
-
-ZKProofport is registered with the Ministry of the Interior and Safety as a Korea Mobile ID integration service (모바일 신분증 연계서비스). The three circuits below are in beta: `CIRCUIT_SUPPORT_STATUS` reports each of them as `planned`, and their input shape and public-input layout can change without a major version bump.
-
-### `mdl_kr_ownership`
-
-Proves the user holds a valid Korean mobile driver's license (모바일 신분증). The license data stays on-device; only the attributes selected by `discloseFlags` are revealed. No wallet signer is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `scope` | `string` | Yes | Application-specific identifier for proof uniqueness. Non-empty, 256 characters or fewer, no control characters. |
-| `discloseFlags` | `number` | No | Attribute disclosure bitmask, integer 0–15 (`0x01` name, `0x02` birth, `0x04` sex, `0x08` phone). Omit or `0` for a fully anonymous ownership proof. |
-
-```typescript
-// Anonymous "holds a valid Korean mobile ID" proof
-const relay = await sdk.createRelayRequest('mdl_kr_ownership', {
-  scope: 'myapp.com',
-});
-```
-
-### `mdl_kr_age`
-
-Proves the user is at least `ageThreshold` years old according to their Korean mobile driver's license, without revealing the birth date. No wallet signer is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `scope` | `string` | Yes | Application-specific identifier (same rules as above) |
-| `ageThreshold` | `number` | Yes | Minimum age to prove — integer between 1 and 150 (e.g. `19` for Korean adult verification) |
-
-```typescript
-const relay = await sdk.createRelayRequest('mdl_kr_age', {
-  scope: 'myapp.com',
-  ageThreshold: 19,
-});
-```
-
-### `mdl_kr_region`
-
-Proves the user's registered address is in the specified si/do region without revealing the full address. No wallet signer is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `scope` | `string` | Yes | Application-specific identifier (same rules as above) |
-| `targetRegion` | `string` | Yes | Region (si/do) to prove residency in, in Korean (e.g. `'경기도'`, `'서울특별시'`). Non-empty, 256 characters or fewer, no control characters. |
-
-```typescript
-const relay = await sdk.createRelayRequest('mdl_kr_region', {
-  scope: 'myapp.com',
-  targetRegion: '경기도',
-});
-```
-
-> mDL inputs are checked before the request leaves your process: a missing `scope`, an out-of-range `discloseFlags`, a non-integer `ageThreshold` or an empty `targetRegion` throws locally instead of coming back as a relay error.
-
-> The mDL circuits do not require `setSigner()` — the proof is bound to the license via an on-device nullifier (`nullifier_value` public input), not a wallet address. Use `sdk.extractNullifier(publicInputs, circuit)` for sybil-resistant user identification.
-
 ## Integration Guide
 
 ### Step 1: Initialize
@@ -438,7 +378,7 @@ interface WalletSigner {
 
 Any ethers v5/v6 `Signer` is compatible.
 
-> **When you can skip this step:** the OIDC Domain and the three mDL circuits never sign a challenge. Calling `createRelayRequest` for those circuits without a signer works. Calling it for a Coinbase circuit without one throws `Signer not set. Call setSigner() first. Wallet signature is required for this circuit.`
+> **When you can skip this step:** the OIDC Domain circuit never signs a challenge. Calling `createRelayRequest` for it without a signer works. Calling it for a Coinbase circuit without one throws `Signer not set. Call setSigner() first. Wallet signature is required for this circuit.`
 
 #### About challenge-signature
 
@@ -625,7 +565,7 @@ if (ProofportSDK.isMobile()) {
 
 ```typescript
 const result = await sdk.waitForProof(relay.requestId, {
-  timeoutMs: 300000, // 5 minutes (default)
+  timeoutMs: 600000, // 10 minutes (default)
   onStatusChange: (update) => {
     console.log('Status:', update.status);
   },
@@ -658,7 +598,7 @@ const once = await sdk.pollResult(relay.requestId);
 // Poll until terminal state
 const result = await sdk.waitForResult(relay.requestId, {
   intervalMs: 2000,
-  timeoutMs: 300000,
+  timeoutMs: 600000,
   onStatusChange: (result) => console.log(result.status),
 });
 ```
@@ -738,7 +678,7 @@ switch (result.status) {
 
 `isTerminalRelayStatus(status)` and `RELAY_TERMINAL_STATUSES` are exported for code that drives `pollResult()` in a loop of its own.
 
-The relay answers `'expired'` before the SDK's default `timeoutMs` (300 000 ms) runs out, so with the defaults you get a result to branch on rather than a thrown timeout. If you pass a much shorter `timeoutMs`, the SDK's own timeout can still fire first and the promise rejects.
+The relay answers `'expired'` before the SDK's default `timeoutMs` (600 000 ms) runs out, so with the defaults you get a result to branch on rather than a thrown timeout. If you pass a much shorter `timeoutMs`, the SDK's own timeout can still fire first and the promise rejects.
 
 #### What is not on the result
 
@@ -772,6 +712,7 @@ The relay answers `'expired'` before the SDK's default `timeoutMs` (300 000 ms)
 | `publicInputs` | `string[]` | When completed | `result.publicInputs` |
 | `verifierAddress` | `string` | No | `result.verifierAddress`. Optional. When present it must match the SDK's own verifier for the circuit, or verification is refused |
 | `chainId` | `number` | No | `result.chainId`. Optional. When present it must match the network the SDK verifies the circuit on, or verification is refused |
+| `signerVariant` | `string` | No | `result.signerVariant`. Copy it unchanged whenever the relay sends it: some circuits are proved by more than one package, each with its own verifier, and this field says which one made the proof (`standard`, `android` or `android_factory`). When it is absent the circuit's standard verifier is used, and a proof that has another package's size is refused; an unrecognised value is refused by name |
 | `numPublicInputs` | `number` | No | Never delivered by the relay, and never read during verification — `publicInputs.length` is used instead. Omit it |
 | `timestamp` | `number` | No | Not delivered by the relay. Omit it |
 | `error` | `string` | On failure | `result.error`. Carried for your own logging; verification ignores it |
@@ -784,11 +725,13 @@ Verify the proof cryptographically by calling the deployed Solidity verifier con
 
 `verifyResponseOnChain` checks the proof against the verifier contract the SDK ships with for that circuit. Which contract judges a proof is never taken from the proof's own response: the SDK carries the deployed verifiers, generated from the circuits' deployment records, and a response whose `verifierAddress` or `chainId` differs from them is refused rather than checked elsewhere. If you configure your own verifier in the SDK's `verifiers` option, that one is used instead.
 
-For OIDC domain proofs the SDK also checks that the proof was made with a signing key Google or Microsoft actually publishes. That key is part of the proof's public inputs, so a proof made with a self-generated key would otherwise pass the contract. The SDK fetches the provider's published keys, caches them as the provider's own cache headers allow, and returns `{ valid: false, error }` when the key is not among them or the keys cannot be fetched. Every verify method does this; there is nothing to call separately.
+For OIDC domain proofs the SDK first checks what the proof says about the sign-in token: it must have been issued to a ZKProofport sign-in client (not to some other website), the proof must have been made within the last 15 minutes (and not more than 5 minutes ahead of your clock), and a proof made by the ZKProofport app must carry the nonce of **your** request — so a proof made for another request cannot be replayed as the answer to yours. For a request you created with `createRelayRequest` on the same SDK instance this happens automatically. If you verify in a different process (or after a restart), pass the request back: `sdk.verifyResponseOnChain(response, provider, { request: { scope, requestId } })`, with the scope you requested and the `requestId` the relay returned; without it an OIDC response is refused. `verifyOnChain` and `verifyResponseOffChain` take the same `request` option.
+
+The SDK also checks that the proof was made with a signing key Google or Microsoft actually publishes. That key is part of the proof's public inputs, so a proof made with a self-generated key would otherwise pass the contract. The SDK fetches the provider's published keys, caches them as the provider's own cache headers allow, and returns `{ valid: false, error }` when the key is not among them or the keys cannot be fetched. Every verify method does this; there is nothing to call separately.
 
 For Coinbase KYC, Coinbase country and GIWA proofs the SDK checks that the attestation's signer belongs to the published signer set: the proof carries the root of the signer list it was made against, and a proof made against any other list is refused with `{ valid: false, error }`. This too runs in every verify method.
 
-The one limit: a proof made with a key the provider has already withdrawn, which this process never saw while it was published, cannot be checked and is refused. Keys seen while published stay acceptable for 24 hours after they disappear.
+The one limit: a proof made with a key the provider has already withdrawn, which this process never saw while it was published, cannot be checked and is refused. Keys seen while published stay acceptable for 1 hour after they were last listed.
 
 
 
@@ -804,6 +747,7 @@ if (result.status === 'completed') {
     publicInputs: result.publicInputs,
     verifierAddress: result.verifierAddress,
     chainId: result.chainId,
+    signerVariant: result.signerVariant,
   };
 
   const verification = await sdk.verifyResponseOnChain(response);
@@ -879,7 +823,7 @@ if (sdk.extractScope(publicInputs, circuit) !== expectedScope) {
 The nullifier is a deterministic hash over the user's credential and the scope:
 
 - **Deterministic** — same user, same scope, same nullifier, every time. That is what makes duplicate detection possible.
-- **Privacy-preserving** — the wallet address (Coinbase), the email (OIDC) and the licence (mDL) stay hidden. There is no way back from the nullifier to the person.
+- **Privacy-preserving** — the wallet address (Coinbase) and the email (OIDC) stay hidden. There is no way back from the nullifier to the person.
 - **Scope-bound** — the same user proving to a different scope produces an unrelated nullifier, so your users cannot be correlated across apps.
 
 On your side, it is the primary key of a verified user. Store it once verification succeeds, with a unique constraint, and check it before granting anything:
@@ -927,18 +871,15 @@ import {
   extractDomainFromPublicInputs,
 } from '@zkproofport-app/sdk';
 
-// Scope and nullifier work for all six circuits — the layout is picked from the
+// Scope and nullifier work for all five circuits — the layout is picked from the
 // circuit id, so always pass it:
 const scope = extractScopeFromPublicInputs(publicInputs, 'coinbase_attestation');
 const nullifier = extractNullifierFromPublicInputs(publicInputs, 'coinbase_attestation');
 
-// OIDC domain attestation uses a different public input layout (148 fields)
+// OIDC domain attestation uses a different public input layout (214 fields)
 const oidcScope = extractScopeFromPublicInputs(publicInputs, 'oidc_domain_attestation');
 const oidcNullifier = extractNullifierFromPublicInputs(publicInputs, 'oidc_domain_attestation');
 
-// The three mDL circuits share one layout
-const mdlNullifier = extractNullifierFromPublicInputs(publicInputs, 'mdl_kr_age');
-
 // Extract domain from OIDC Domain Attestation
 const domain = extractDomainFromPublicInputs(publicInputs, 'oidc_domain_attestation');
 // domain: 'example.com', or null if the circuit doesn't match or inputs are insufficient
@@ -1049,9 +990,6 @@ import type {
   OidcDomainInputs,
   ActionBoundInputs,
   TypedAction,
-  MdlKrOwnershipInputs,
-  MdlKrAgeInputs,
-  MdlKrRegionInputs,
   CircuitInputs,
   ProofRequest,
   ProofResponse,
@@ -1067,20 +1005,17 @@ import type {
 
 | Type | Description |
 |------|-------------|
-| `CircuitId` | Union of the eight canonical circuit IDs — `'coinbase_attestation' \| 'coinbase_country_attestation' \| 'oidc_domain_attestation' \| 'giwa_attestation' \| 'dojang_playground' \| 'mdl_kr_ownership' \| 'mdl_kr_age' \| 'mdl_kr_region'`. Also exported from `@zkproofport-app/sdk/circuits` |
+| `CircuitId` | Union of the five canonical circuit IDs — `'coinbase_attestation' \| 'coinbase_country_attestation' \| 'oidc_domain_attestation' \| 'giwa_attestation' \| 'dojang_playground'`. Also exported from `@zkproofport-app/sdk/circuits` |
 | `TypedAction` | The EIP-712 action a `giwa_attestation` proof binds to: `{ domain, types, primaryType, message }` — the same object `eth_signTypedData_v4` takes |
-| `CircuitSupportStatus` | `'supported' \| 'planned'` — see [Circuit Identifiers](#circuit-identifiers) |
+| `CircuitSupportStatus` | `'supported' \| 'experimental' \| 'planned'` — see [Circuit Identifiers](#circuit-identifiers) |
 | `CircuitType` | Alias of `CircuitId`. Kept as the name used throughout `ProofRequest`, `ProofResponse` and the SDK methods |
 | `ProofRequestStatus` | `'pending' \| 'completed' \| 'error' \| 'cancelled'` — the status on a `ProofResponse` |
 | `CoinbaseKycInputs` | Inputs for `coinbase_attestation`: `{ scope, userAddress?, rawTransaction? }` |
 | `CoinbaseCountryInputs` | Inputs for `coinbase_country_attestation`: `{ scope, countryList, isIncluded, userAddress?, rawTransaction? }` |
 | `OidcDomainInputs` | Inputs for `oidc_domain_attestation`: `{ domain, scope, provider? }` |
-| `MdlKrOwnershipInputs` | Inputs for `mdl_kr_ownership`: `{ scope, discloseFlags? }` |
 | `ActionBoundInputs` | Inputs for the circuits that can bind an EIP-712 action: `{ scope, action?, userAddress?, rawTransaction? }`. Whether the action is required is the circuit's property, in `CIRCUIT_ACTION_BINDING` — optional for `giwa_attestation` and `dojang_playground` |
 | `GiwaAttestationInputs` | Alias of `ActionBoundInputs`, for `giwa_attestation` |
 | `DojangPlaygroundInputs` | Alias of `ActionBoundInputs`, for `dojang_playground` |
-| `MdlKrAgeInputs` | Inputs for `mdl_kr_age`: `{ scope, ageThreshold }` |
-| `MdlKrRegionInputs` | Inputs for `mdl_kr_region`: `{ scope, targetRegion }` |
 | `CircuitInputs` | Union of every input type above (plus an empty-input form for circuits that need nothing from the dApp) |
 | `ProofRequest` | Request object: `requestId`, `circuit`, `inputs`, `createdAt`, plus optional `message`, `dappName`, `dappIcon`, `returnScheme` (a bare scheme such as `mydapp://`), `expiresAt` |
 | `ProofResponse` | What `verifyResponseOnChain()` takes: `requestId`, `circuit`, `status`, and — when completed — `proof`, `publicInputs`, `verifierAddress`, `chainId`; `error` when it failed. `numPublicInputs` and `timestamp` also exist but the relay never fills them, so omit them. Field by field in [Step 6](#step-6-read-the-result) |
@@ -1114,7 +1049,6 @@ import {
   COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT,
   COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT,
   OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT,
-  MDL_KR_PUBLIC_INPUT_LAYOUT,
 } from '@zkproofport-app/sdk';
 ```
 
@@ -1156,7 +1090,7 @@ const signalHash = toBytes32(publicInputs.slice(L.SIGNAL_HASH_START, L.SIGNAL_HA
 
 The country list and the `is_included` flag are public inputs, which means the proof is only as strong as the list it was proved against. Read indices 64–85 back and confirm they are the list and the direction you asked for; a valid proof against a different list is still a valid proof.
 
-### `oidc_domain_attestation` — 148 entries
+### `oidc_domain_attestation` — 214 entries
 
 | Index | Constants | Circuit field | What it is |
 |-------|-----------|---------------|------------|
@@ -1166,39 +1100,17 @@ The country list and the `is_included` flag are public inputs, which means the p
 | 83–114 | `SCOPE_START` / `_END` | `scope` | `bytes32` scope hash |
 | 115–146 | `NULLIFIER_START` / `_END` | `nullifier` | `bytes32` over the user's email and the scope |
 | 147 | `PROVIDER` | `provider` | `0` = Google, `1` = Microsoft. The circuit accepts no other value |
+| 148–179 | `AUD_HASH_START` / `_END` | `aud_hash` | keccak256 of the ID token's `aud` (the sign-in client it was issued to) |
+| 180 | `NONCE_MODE` | `nonce_mode` | `1` = the token's nonce is bound to your request, `0` = no nonce (agent device sign-in) |
+| 181–212 | `NONCE_BINDING_START` / `_END` | `nonce_binding` | In mode `1`, keccak256("zkproofport-oidc-v1" ‖ keccak256(scope) ‖ requestId); all zero in mode `0` |
+| 213 | `NOW` | `now` | Unix seconds the proof was made at; the circuit proves the token was valid then |
+
+Proofs from the earlier 148-entry version of this circuit bind no audience, expiry or nonce and are refused by every verify method.
 
 `DOMAIN_START` and `DOMAIN_END` are kept as deprecated aliases of `DOMAIN_STORAGE_START` and `DOMAIN_LEN`. Use the current names — the old pair reads as a range and is not one.
 
 Index 147 tells you which issuer signed the token, not whether the account belongs to an organisation. Workspace and Microsoft 365 membership is checked on-device only when you set `provider` in the request; if you did not set it, do not read a membership guarantee out of this field.
 
-### Korea Mobile ID (mDL) — one layout, three circuits
-
-All three mDL circuits share the same first 64 entries and differ after that. Entries are single bytes, except `age_threshold` and `current_year`, which each hold their whole value in one entry.
-
-| Index | Constants | Circuit field | Applies to |
-|-------|-----------|---------------|------------|
-| 0–31 | `SCOPE_START` / `_END` | `scope` | all three |
-| 32–63 | `NULLIFIER_START` / `_END` | `nullifier_value` | all three |
-| 64 | `OWNERSHIP_DISCLOSE_FLAGS` | `disclose_flags` | `mdl_kr_ownership` (97 entries) — the bitmask that was actually proved (`0x01` name, `0x02` birth, `0x04` sex, `0x08` phone) |
-| 65–96 | `OWNERSHIP_OWNER_COMMIT_START` / `_END` | `owner_commit` | `mdl_kr_ownership` — `bytes32` commitment to the disclosed attributes. All zero when `disclose_flags` is `0`, which is the anonymous case |
-| 64 | `AGE_THRESHOLD` | `age_threshold` | `mdl_kr_age` (66 entries) — the age the proof actually clears. Read it back; it is a public input, so confirm it is the threshold you asked for |
-| 65 | `AGE_CURRENT_YEAR` | `current_year` | `mdl_kr_age` — the year the comparison was made in |
-| 64–95 | `REGION_CODE_START` / `_END` | `region_code` | `mdl_kr_region` (96 entries) — `bytes32`, not a readable region name. See below |
-
-`region_code` is `keccak256` over the region name, UTF-8 and zero-padded to 64 bytes. The circuit proves that the region on the licence hashes to this value, but the value itself is a public input — so recompute it from the region you asked for and compare, exactly as you do with the scope:
-
-```typescript
-import { keccak256 } from 'ethers';
-
-const regionCodeFor = (region: string): string => {
-  const padded = new Uint8Array(64);
-  padded.set(new TextEncoder().encode(region));
-  return keccak256(padded);
-};
-
-// regionCodeFor('경기도') — compare against indices 64–95, rebuilt with toBytes32()
-```
-
 ## Error Handling
 
 Async SDK methods throw standard `Error` objects. The messages are stable enough to log, not to switch on:
@@ -1212,9 +1124,9 @@ try {
 }
 
 try {
-  await sdk.createRelayRequest('mdl_kr_age', { scope: 'app.com', ageThreshold: 0 });
+  await sdk.createRelayRequest('coinbase-kyc', { scope: 'app.com' });
 } catch (err) {
-  // "ageThreshold is required and must be an integer between 1 and 150 (circuit: mdl_kr_age)"
+  // "Unknown circuit 'coinbase-kyc'. Expected: coinbase_attestation, ..."
 }
 
 try {

package/dist/ProofportSDK.d.ts

@@ -3,6 +3,7 @@
  */
 import type { ProofRequest, ProofResponse, CircuitType, CircuitInputs, ProofportConfig, QRCodeOptions, ChallengeResponse, WalletSigner, RelayProofRequest, RelayProofResult } from './types';
 import { type OffChainVerifyOptions } from './offChainVerifier';
+import { type OidcRequestContext } from './verifier';
 import type { SDKEnvironment } from './types';
 /**
  * Main SDK class for interacting with the ZKProofport mobile app.
@@ -41,6 +42,15 @@ import type { SDKEnvironment } from './types';
 export declare class ProofportSDK {
     private config;
     private pendingRequests;
+    /**
+     * requestId -> scope of the relay requests this instance created, so that
+     * verifyResponse* can check an OIDC proof's request-bound nonce without the
+     * dApp passing the request back in. Oldest entries go first past
+     * {@link ProofportSDK.MAX_REMEMBERED_RELAY_REQUESTS}.
+     */
+    private relayRequests;
+    /** Bound on {@link relayRequests}; a dApp that verifies later can pass the request explicitly. */
+    static readonly MAX_REMEMBERED_RELAY_REQUESTS = 1000;
     private signer;
     private relayUrl;
     private socket;
@@ -179,22 +189,6 @@ export declare class ProofportSDK {
      * falling through to another circuit's builder.
      */
     private static readonly REQUEST_BUILDERS;
-    /**
-     * @internal
-     * Creates a Korea Mobile ID (mDL) proof request for any of the three
-     * mDL predicate circuits (ownership / age / region).
-     *
-     * The mobile app collects the license data on-device; the dapp only
-     * supplies the predicate parameters validated here. No wallet signature
-     * is required for mDL circuits.
-     *
-     * @param circuit - 'mdl_kr_ownership' | 'mdl_kr_age' | 'mdl_kr_region'
-     * @param inputs - Predicate inputs (see MdlKr*Inputs types)
-     * @param options - Request configuration options
-     *
-     * @throws Error if the predicate inputs fail validation
-     */
-    private createMdlKrRequest;
     /**
      * @internal
      * Generates a deep link URL for a proof request.
@@ -497,10 +491,24 @@ export declare class ProofportSDK {
      * }
      * ```
      */
-    verifyOnChain(circuit: CircuitType, proof: string, publicInputs: string[], providerOrSigner?: any): Promise<{
+    verifyOnChain(circuit: CircuitType, proof: string, publicInputs: string[], providerOrSigner?: any, options?: {
+        request?: OidcRequestContext;
+        signerVariant?: string;
+    }): Promise<{
         valid: boolean;
         error?: string;
     }>;
+    /**
+     * The request an `oidc_domain_attestation` response answers: the one the
+     * caller passed, else the relay request this instance created under the
+     * response's requestId. `{ error }` when there is none, or when the two
+     * disagree -- an OIDC proof made with a request-bound nonce is only
+     * meaningful against the request it was bound to, so a response this SDK
+     * cannot place is refused rather than checked without it.
+     */
+    private oidcRequestFor;
+    /** @internal Remember a relay request's scope for verifyResponse*. */
+    private rememberRelayRequest;
     /**
      * The verifier for a circuit: the one the dApp configured, otherwise the
      * pinned deployment on the chain this SDK's environment verifies that
@@ -516,6 +524,9 @@ export declare class ProofportSDK {
      *
      * @param response - ProofResponse object from parseResponse()
      * @param providerOrSigner - ethers v6 Provider or Signer (defaults to base mainnet public RPC)
+     * @param options.request - For `oidc_domain_attestation`: the `{ scope, requestId }`
+     *   the response answers. Not needed for a relay request this SDK instance
+     *   created; an OIDC response this instance cannot place is refused without it.
      *
      * @returns Promise resolving to verification result with valid boolean and optional error message
      *
@@ -542,7 +553,9 @@ export declare class ProofportSDK {
      * });
      * ```
      */
-    verifyResponseOnChain(response: ProofResponse, providerOrSigner?: any): Promise<{
+    verifyResponseOnChain(response: ProofResponse, providerOrSigner?: any, options?: {
+        request?: OidcRequestContext;
+    }): Promise<{
         valid: boolean;
         error?: string;
     }>;
@@ -896,7 +909,7 @@ export declare class ProofportSDK {
      * @param requestId - The relay-issued request ID
      * @param options - Polling options
      * @param options.intervalMs - Polling interval in milliseconds (default: 2000)
-     * @param options.timeoutMs - Maximum polling time in milliseconds (default: 300000 = 5 min)
+     * @param options.timeoutMs - Maximum polling time in milliseconds (default: 600000 = 10 min, `DEFAULT_RELAY_WAIT_MS`)
      * @param options.onStatusChange - Callback when status changes
      * @returns Promise resolving to final RelayProofResult
      * @throws Error if timeout or relay error
@@ -961,7 +974,7 @@ export declare class ProofportSDK {
      *
      * @param requestId - The relay-issued request ID
      * @param options - Configuration options
-     * @param options.timeoutMs - Maximum wait time in ms (default: 300000 = 5 min)
+     * @param options.timeoutMs - Maximum wait time in ms (default: 600000 = 10 min, `DEFAULT_RELAY_WAIT_MS`)
      * @param options.onStatusChange - Callback for status updates
      * @returns Promise resolving to final RelayProofResult
      */

package/dist/constants.d.ts

@@ -20,7 +20,7 @@ export declare const RELAY_URLS: Record<SDKEnvironment, string>;
  * Mirrors the mobile app's `CIRCUIT_NETWORKS` (proofport-app
  * src/config/contracts.ts), because a proof is checked where the app said its
  * verifier is: Base for the Coinbase and OIDC circuits, GIWA Sepolia for GIWA
- * and Dojang (testnet-only), Base Sepolia for Korea Mobile ID (testnet-only).
+ * and Dojang (testnet-only).
  * The ADDRESS on that chain always comes from core's pinned table, never from
  * a proof response.
  */
@@ -31,9 +31,6 @@ export declare const VERIFICATION_CHAINS: {
         readonly oidc_domain_attestation: 8453;
         readonly giwa_attestation: 91342;
         readonly dojang_playground: 91342;
-        readonly mdl_kr_ownership: 84532;
-        readonly mdl_kr_age: 84532;
-        readonly mdl_kr_region: 84532;
     };
     readonly staging: {
         readonly coinbase_attestation: 84532;
@@ -41,9 +38,6 @@ export declare const VERIFICATION_CHAINS: {
         readonly oidc_domain_attestation: 84532;
         readonly giwa_attestation: 91342;
         readonly dojang_playground: 91342;
-        readonly mdl_kr_ownership: 84532;
-        readonly mdl_kr_age: 84532;
-        readonly mdl_kr_region: 84532;
     };
     readonly local: {
         readonly coinbase_attestation: 84532;
@@ -51,9 +45,6 @@ export declare const VERIFICATION_CHAINS: {
         readonly oidc_domain_attestation: 84532;
         readonly giwa_attestation: 91342;
         readonly dojang_playground: 91342;
-        readonly mdl_kr_ownership: 84532;
-        readonly mdl_kr_age: 84532;
-        readonly mdl_kr_region: 84532;
     };
 };
 /**
@@ -132,4 +123,4 @@ export declare const DEFAULT_REQUEST_EXPIRY_MS: number;
  * ```
  */
 export declare const MAX_QR_DATA_SIZE = 2953;
-export { VERIFIER_ABI, RPC_ENDPOINTS, COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, MDL_KR_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, } from '@zkproofport-app/core';
+export { VERIFIER_ABI, RPC_ENDPOINTS, COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, } from '@zkproofport-app/core';

package/dist/deeplink.d.ts

@@ -1,7 +1,7 @@
 /**
  * Deep Link utilities for ZKProofport SDK
  */
-import type { ProofRequest, ProofResponse, CircuitInputs, DeepLinkComponents } from './types';
+import type { ProofRequest, ProofResponse, DeepLinkComponents } from './types';
 /**
  * Generates a unique request ID for proof requests.
  *
@@ -170,23 +170,6 @@ export declare function parseDeepLink(url: string): DeepLinkComponents | null;
  * ```
  */
 export declare function isProofportDeepLink(url: string, scheme?: string): boolean;
-/**
- * Validates dapp-supplied inputs for the Korea Mobile ID (mDL) circuits.
- * Shared by deep-link request validation and relay request creation so the
- * same guards apply on every request path.
- *
- * Rules:
- * - `scope` — required non-empty string, ≤256 chars, no control characters
- * - `mdl_kr_ownership.discloseFlags` — optional integer 0–15 (0x0F bitmask)
- * - `mdl_kr_age.ageThreshold` — required integer 1–150
- * - `mdl_kr_region.targetRegion` — required non-empty string (Korean si/do),
- *   ≤256 chars, no control characters
- *
- * @param circuit - One of the three mDL circuit identifiers
- * @param inputs - Dapp-supplied circuit inputs
- * @returns Error message string, or null when the inputs are valid
- */
-export declare function validateMdlInputs(circuit: 'mdl_kr_ownership' | 'mdl_kr_age' | 'mdl_kr_region', inputs: CircuitInputs): string | null;
 /**
  * Longest accepted `returnScheme` value.
  * Kept in sync with proofport-relay `src/returnScheme.ts`.
@@ -273,6 +256,22 @@ export declare function validateReturnScheme(value: unknown): string | null;
  * @internal
  */
 export declare function detectReturnScheme(userAgent?: string): string | undefined;
+/**
+ * @internal
+ * Validates a proof request for completeness and correctness.
+ *
+ * Performs comprehensive validation including:
+ * - Required fields (requestId, circuit, callbackUrl)
+ * - Circuit type validity (must be a supported circuit)
+ * - Circuit-specific input validation (e.g., userAddress format, countryList structure)
+ * - Expiration check (if expiresAt is provided)
+ *
+ * Note: userAddress is optional for both circuits - the mobile app will prompt
+ * for wallet connection if not provided.
+ *
+ * @param request - Proof request to validate
+ * @returns Validation result with `valid` flag and optional `error` message
+ */
 export declare function validateProofRequest(request: ProofRequest): {
     valid: boolean;
     error?: string;

package/dist/index.d.ts

@@ -27,15 +27,17 @@
  */
 export { ProofportSDK, default } from './ProofportSDK';
 export { extractScopeFromPublicInputs, extractNullifierFromPublicInputs, extractDomainFromPublicInputs, } from './verifier';
-export { CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS, ALL_CIRCUIT_IDS, SUPPORTED_CIRCUIT_IDS, EXPERIMENTAL_CIRCUIT_IDS, PLANNED_CIRCUIT_IDS, isCircuitId, isSupportedCircuitId, getCircuitSupportStatus, CIRCUIT_VK_PATHS, } from './circuits';
+export { CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS, ALL_CIRCUIT_IDS, SUPPORTED_CIRCUIT_IDS, EXPERIMENTAL_CIRCUIT_IDS, PLANNED_CIRCUIT_IDS, isCircuitId, isSupportedCircuitId, getCircuitSupportStatus, CIRCUIT_VK_PATHS, CIRCUIT_PACKAGES, SIGNER_VARIANTS, isSignerVariant, signerVariantsOf, getCircuitPackage, resolveSignerVariant, evmProofByteLength, } from './circuits';
 export { verifyProofOffChain } from './offChainVerifier';
 export type { OffChainVerifyResult, OffChainVerifyOptions, } from './offChainVerifier';
-export { PINNED_VERIFIERS, getPinnedVerifier } from './verifier';
+export { PINNED_VERIFIERS, PINNED_VARIANT_VERIFIERS, getPinnedVerifier, getPinnedVariantVerifier } from './verifier';
 export type { PinnedVerifier } from './verifier';
-export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, MDL_KR_PUBLIC_INPUT_LAYOUT, } from './constants';
-export type { CircuitId, CircuitSupportStatus } from './circuits';
+export { checkOidcPolicy, deriveOidcNonceBinding, oidcAudienceHash, OIDC_ALLOWED_AUDIENCES, OIDC_NONCE_DOMAIN, OIDC_NOW_MAX_AGE_SECONDS, OIDC_NOW_MAX_FUTURE_SECONDS, OIDC_V1_PUBLIC_INPUT_COUNT, OIDC_V2_PUBLIC_INPUT_COUNT, } from './verifier';
+export type { OidcRequestContext, OidcAudience, OidcNonceMode } from './verifier';
+export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, } from './constants';
+export type { CircuitId, CircuitSupportStatus, SignerVariant, CircuitPackage } from './circuits';
 export { CIRCUIT_ACTION_BINDING, circuitActionBinding, } from './circuits';
 export type { CircuitActionBinding } from './circuits';
-export type { CircuitType, ProofRequestStatus, CoinbaseKycInputs, ActionBoundInputs, GiwaAttestationInputs, DojangPlaygroundInputs, TypedAction, CoinbaseCountryInputs, OidcDomainInputs, MdlKrOwnershipInputs, MdlKrAgeInputs, MdlKrRegionInputs, CircuitInputs, ProofRequest, ProofResponse, QRCodeOptions, VerifierContract, ProofportConfig, ChallengeResponse, WalletSigner, RelayProofRequest, RelayProofResult, RelayProofStatus, RelayTerminalStatus, SDKEnvironment, } from './types';
-export { RELAY_TERMINAL_STATUSES, isTerminalRelayStatus } from './relayStatus';
+export type { CircuitType, ProofRequestStatus, CoinbaseKycInputs, ActionBoundInputs, GiwaAttestationInputs, DojangPlaygroundInputs, TypedAction, CoinbaseCountryInputs, OidcDomainInputs, CircuitInputs, ProofRequest, ProofResponse, QRCodeOptions, VerifierContract, ProofportConfig, ChallengeResponse, WalletSigner, RelayProofRequest, RelayProofResult, RelayProofStatus, RelayTerminalStatus, SDKEnvironment, } from './types';
+export { RELAY_TERMINAL_STATUSES, isTerminalRelayStatus, DEFAULT_RELAY_WAIT_MS } from './relayStatus';
 export { validateTypedAction, parseTypedAction } from './typedAction';